Adobe Connect Recording: Attendance is on the wiki page:

Transcription

1 Page 1 ICANN Transcription EPDP on the Temporary Specification for gtld Registration Data Thursday 06 December 2018 at 1400 UTC Note: Although the transcription is largely accurate, in some cases it is incomplete or inaccurate due to inaudible passages or transcription errors. It is posted as an aid to understanding the proceedings at the meeting, but should not be treated as an authoritative record. The audio is also available at: Adobe Connect Recording: Attendance is on the wiki page: The recordings and transcriptions of the calls are posted on the GNSO Master Calendar page: Coordinator: Thank you. Recordings have started. Terri Agnew: Thank you. Good morning, good afternoon and good evening and welcome to the 32nd GNSO EPDP Team meeting taking place on the 6th of December, 2018 at 1400 UTC. In the interest of time, there will be no roll call. Attendance will be taken via the Adobe Connect room. If you're only on the telephone bridge could you please let yourself be known now? Hearing no one, we have listed apologies from Ayden Férdeline, NCSG; Diane Plaut, IPC and Emily Taylor of the RrSG. They have formally assigned Tatiana Tropina, and Lindsay Hamilton- Reid as their alternates for this call and any remaining days of absence.

2 Page 2 During this period, the members will have only read-only rights and no access to conference calls. Their alternates will have posting rights and access to conference calls until the member s return date. As a reminder, the alternate assignment form must be formalized by the way the Google assignment form; the link is available in the agenda pod to the right and also in the meeting invite . Statements of interest must be kept up to date. If anyone has any updates to share, please raise your hand or speak up now. Seeing or hearing no one, if you need assistance updating your statement of interest please the GNSO Secretariat. All documentation and information can be found on the EPDP wiki space and there is an audiocast for nonmembers to follow the call so please remember to state your name before speaking. Recordings will be circulated on the mailing list and posted on the public wiki space shortly after the end of the call. Thank you and I ll turn it back over to our chair, Kurt Pritz. Please begin. Great. Thanks, Terri. And hi, everyone. So we're two hours away from my favorite time of the week. So if you ll scan you ve already scanned down the agenda, there s a couple other items I want to cover today that I will in the so I think I ll just start with that. One is so the very first thing is the outstanding action items. And I think there s two. Marika, I think they're kind of both on my plate but you want to mention those, Marika? Or are you having ((Crosstalk)) Marika Konings: Yes, thanks. Go ahead.

3 Page 3 Marika Konings: Yes, I m having some other reconnect issues but I m still on the phone. So the two that are outstanding are in relation to two messages that are supposed to be sent to ICANN Org, first one regarding the data processing agreement with escrow providers and the other one with dispute resolution providers, so I think those are still outstanding. And then there as well a couple of people that indicated that they were interested in participating in the small team conversation on the controller related questions that have not filled out the Doodle poll yet so please do that as soon as possible so we can schedule that call. Thanks very much. And so I ll take care of those notices those write-ups with the questions to ICANN today or tomorrow and we ll make sure they're out by the start of the week. Okay, so with that there s three items I want to cover at the outset of the meeting. One has to do with the letter to the European Data Protection Board, so I don't know if you want to put up a version of that. Stephanie did some great work on that; Hadia added some thoughtful edits and so did Kavouss. And I think what's coming up here is it s not the clean version but close to the clean version of maybe so it s easier to read I don't know what that comment says. I m just making it bigger so I can see it. Okay so can you like really quickly just take that comment off so it s bigger and easier to read, Caitlin, it s already small enough so making it 1/3 again smaller is kind of makes it hard. So I have what I have some comments to this and then a plan for getting it published. So first, you know, this is this is going out over mine or Rafik s name so with your indulgence I m going to make some final edits and to put it kind of in Kurt-speak because, you know, I just want to put it in my style but I plan to change none of the substance but I do want to run a few questions by you. And then after I make changes I ll check those over with Stephanie as the primary author and then also with Rafik on this side. So that s what I plan to do and I hope that s okay with everybody.

4 Page 4 I just had a couple questions and I want to go back to an I wrote where I wanted to add a couple things and I wanted to get your take on it. So I wanted to provide a notice that I don't think is in here but maybe it s in because I just read the last versions in the last few minutes, but, you know, I wanted to let the Data Protection Board know we were working on this with all due care but all due haste also; that you know, this ICANN team is picking this up as a matter of urgency. I also thought we might point out that there s a summary in the initial report that s kind of easy to read and that it s been translated into the UN languages if that's helpful to them. I also thought we might point out that we do have legal questions and we're seeking outside counsel in consultation with DPAs. And I also wanted to provide a notice that our final report was would be forthcoming so part of the reason for this is so the final report doesn t come as a surprise to them. So those were the additions I wanted to make but they re not in this version so I wanted to get some feedback on those. Ashley. Ashley Heineman: Well to answer your question I don't really have any feedback on that. I was going to provide some other edits to the document. I m happy to reserve those until you get responses to your questions if that s more appropriate. No, go ahead, Ashley. Please do. Ashley Heineman: Yes, and I apologize, I m having a hard time keeping up with all my s lately. But I just wanted to propose and it may have already been proposed and shot down in the first paragraph where we're talking about the role of ICANN and it now says something along the lines of ICANN is a global nonprofit organization responsible for ensuring the stable and secure operation of the Internet system of unique identifiers. I just wonder why we can't say the domain name system rather than unique identifiers?

5 Page 5 And the only the reason why I m saying that is because when we start talking about unique identifiers and then spelling out, you know, protocol parameters, IP addresses, we really start confusing this with the IANA functions as opposed to ICANN s mission and domain name policy development. So I just really would like that we stick to the domain name system if at all possible as I think it probably includes what people are trying to refer to here anyway. Also when we get to the second paragraph and we're talking about I think it s I m trying to find it, hold on, let me pull up my notes, I m sorry, it is the last of the first paragraph and it s the sentence that is talking about ICANN to develop GDPR compliant policy to govern operation procedures relating to the processing of personal data by stakeholders and domain name industry. Rather than saying stakeholders and the domain name industry would it be possible to say instead here personal data by ICANN and its contracted parties? Because I think we're not really there s no responsibility here beyond that and I would hate to kind of muddy the waters by being less than precise so basically just not referring to stakeholders and referring to ICANN and its contracted parties. And that's it. Happy to fight it out, whatever. Thanks. Okay just taking notes. Anyone else? Ashley, I support those edits and just would encourage I think some of the language you mentioned was just lifted right out of the mission but I think your edits are good and so if anyone has I m reading the Stephanie, you and I, let s we ll talk about this and make some decisions. Marc. Marc Anderson: Hey Kurt. Marc Anderson for the transcript. I just wanted to clarify where we are with this letter. I guess my understanding you know, was and, you know, I want to make sure that it still should be that we haven't as a working group agreed that we, you know, definitively agreed that we will be sending this

6 Page 6 letter and that this is more discussion; if we do send this initial letter this is what it would look like. Is that is my understanding still correct? You know, I think that's what the indication had been coming out, you know, previous, you know, the small group calls and the previous updates that, you know, we were still had not definitively decided if this letter would be sent or not. Thanks, Marc. I probably didn't do a good job introducing the topic because I was pulling some other documents together right at the start. So I think that s right that we hadn't decided whether or not to send the letter and the exercise was that we were going to beat the letter up some and stare and it and say this seems like an appropriate thing to do. So I think that's right. I ll also say something that I should have said at the outset and that is because this letter s been edited by a few people there s a few typos in it and we recognize that so those will all be cleaned up before we send it out. Marc Anderson: Okay. Thanks, Kurt. ((Crosstalk)) Right. And in the I sent with comments about the letter I ll say that after thinking about it quite a bit I think it s appropriate to send the letter. I really like the idea of keeping it to one page and to show that we can be succinct and to the point and just, you know, just communicating very few points that we think are important to the Data Privacy Board. Marc Anderson: Okay. Thanks for clarifying. I mean, you know, I just, you know, I just wanted to make sure that that was still the case and, you know, just sort of you know, I ll say for my part, you know, I think I've heard from some people that think sending this letter is a good idea; some people that think it s not. And, you know, I sort of, you know, at this point I sort of find myself, you know, in

7 Page 7 the middle. I think there s arguments to be made on either for either case. And, you know, I guess I want to, you know, with that being the current case I want to make sure we have an opportunity as a working group to deliberate and come to a proper decision on that. So thanks for clarifying. Yes. James. James Bladel: Thanks, Kurt. James speaking. I agree with Marc. I think throughout the editing process there was a presumption that the more we edited this the presumption that we would be sending it grew. And we never really explicitly as a group made that decision. I think that to address Marc s point, I think that the benefits of sending this are, you know, in doubt or in question. I think we have eliminated the potential harms by through the editing process and I think it s probably, for lack of a better word, it s a safer letter now. It essentially just notifies the EDPB of the, you know, of the initial report publication and invites them to comment. And so I don't really see any harm in sending the letter. So I would just ask Kurt and others on the call if we can come out of this call with that as a concrete decision one way or the other I think that would be a good outcome for the next two hours. Thanks. Thank you, James. Georgios. Georgios Tselentis: Yes, hello. I was not in the second decision, if I remember well, two calls. And I remember in the discussion that we said that as it was the initial draft and as the questions were formulated we couldn t see that we would get some answers at least what we wanted. However, what I think the current draft, and I think I said it last time, is and this is in the last paragraph that in a sense we are waiting from the European Data Protection Board to provide comments in general. And I think this is a wishful thinking and this will not happen.

8 Page 8 If so if this letter is to if this letter it is the purpose of sending this letter now as it is now, it s just to inform the European Data Protection Board that we are doing we published the report, we have advanced the some of the issues that were discussed in the previous communication with ICANN, I think, yes, I see no harm but I see no value either at this point. For me, and I think I said it in the first meeting, sending something more precise and more accurate would probably give us some shortcuts to questions that are contentious between the group. But if we don't have the material in a good and the questions are in the right condition to send those questions, I think we shouldn t do it we shouldn t do it at this point. Thank you. Thanks very much, Georgios, that s thoughtful. And so, you know, I think it was the sense of the group that it was that we have questions that need to be answered but they should be answered by others. Everybody recognized the same thing you did is that it s not likely that they're going to read the initial report and comment on it. And additionally, they're likely not to receive specific either/or type questions, we have very well and that we should seek other avenues for getting them answered and that's so that s what we decided to do with the retaining of legal counsel and perhaps consulting with DPAs. I ve lost the queue but I think it s Kavouss. Kavouss, go ahead. How are you? Kavouss Arasteh: Yes good morning, good afternoon, good evening to everybody. I also did some edits. First of all I thank Stephanie and Hadia for their work. And I add some edits so this is my professional activity that I do many, many letters per day for this type of thing. But I don't see anything in our letter which is interesting. We just humbly, and with a lot of courtesy, are saying that what the ICANN is, what the EPDP is and what the GNSO is and then what the GDPR and then saying that please, look at our report. Why we need to formally write a letter to the body and inform them, please look at our report.

9 Page 9 EU has representatives with us; they can raise it. And if they have any question or any not question, any comments, they will raise it. So I don't see any point in the letter. The letter is very (poor) and almost empty. So I have difficulty to send that but you could keep it in your archive after the later stage maybe we find some other interesting elements if some people allows to send those elements, questions, specific question you do that even though somebody says that they are so selfish that they don't want to be questioned by individual and they considered ICANN as individual so in that case we don't send anything at all. If somebody doesn t want to talk with us we (don t) talk to them. So that is the situation. But if everybody agree that we need to send them, we need to send them something useful. This letter has nothing inside that except saying that please read our report. They are part of public comments public people, why we have to remind them? Why not remind others? Thank you. So, Kavouss, before I let you go I have two questions for you. One is were you suggesting that instead we notify the GAC EU rep and let him know so that he can tell people through channels he or she can tell people through channels what's going on? And my second question is, you know, what would make in your opinion what would make the letter meaningful but still appropriate? Kavouss Arasteh: My answer to your first question is, we have representatives from the EU and they could raise not raise they could remind them that there is a initial report if they are (unintelligible) to read that please read that and make a comment like other people. That is the answer to your first question. Second question, if you want to ask European Data Protection Board as a Board, we need to have a valid question. Questions that we need to raise and ask their comments. In this letter I don't find any question. So should we have any questions, please put it in a letter and send it.

10 Page 10 But this is conditional because some people they told in your small team meeting that the Board does not want to receive any questions. If they don't want to receive any questions, why we send them? So in summary, in conclusion, don't send anything (unintelligible) unless everybody agrees that there is a valid topic that we need to ask specific comment or comments from the Board of the Data Protection. Thank you. Any perspectives on Kavouss s comment? And, Georgios, maybe you want to come back to respond, should we be working through the GAC and you as the EU rep or Georgios Tselentis: Thanks, Kurt. If I can briefly respond, from what we know so far on how to approach the Board, there was a certain already with ICANN what we know there was a certain fatigue on the issue with this official letter. So my position was not to have a formal letter exchange with the Board. And also the Board was and this is what I was understanding from the reactions, is that as long as we don't have something specific very, very to the point question describing also the whole process, then they will not make general comments, they will not say and this is what I m saying we are not in a position now, we don't have the right questions or the right the right queries to address to the Board. So and this is referring to what we have in the letter currently. We will not get any response because we don't ask them anything specific. I don't think even they will look at the report, maybe they will some DPAs that are more close to the issue they will have a look but I was not I m not expecting anything in the current formulation as we have it in the letter to have any added value, as I said before, from the European Data Protection Board. I m more inclined to see whether there is an informal way to ask DPAs, even specific DPAs that are more into the issue, but again, with specific questions. And there we are not, I mean, we don't have any formulated the right

11 Page 11 questions to get the right answers. I see a value there but we are not at all in this format that we have now. Thanks very much. That was really thoughtful. So I want to get a sense of the room here, so, you know, I m not, you know, clearly as you guys know me, I m not from that world. But from my world as a manager my thinking was this, that, you know, somebody in the chat said, Data Protection Board is very busy. So for me if I m creating this work product that s pretty intense I don't want and I don't wait to the very end to tell the customer about my work product and say here it is. And then they're surprised and they look at it and, you know, may like it or may find fault with it. So as manager and the word manager includes, you know, managing expectations I think the letter has value in that we're saying look, we're working on this, we've done our initial report, the final report is coming, you know, you're free to look at it if you're so inclined. I think that provides us some degree of I mean, cover is too strong a word but, you know, we've gone to some effort to say hey, we're working on this and we're halfway through and here s our work product so far so that when a final report comes out it s not a surprise and, you know, we have a way to say, you know, we showed you our work halfway through. So I see that as the value of the letter. But my ego s not tied up in it at all and I d be perfectly fine to, you know, write to the GNSO and say, you know, we've listened, you know, we've got some really valuable feedback from some of our members and we think it s inappropriate to write to the Data Protection Board at this time, you know, what do you think, GNSO? So I m for either thing. I just want to rule out. So let s use our hands up and down thing. What kind of option do we have? Do we have green and red? So if you want to send the letter out check Agree and if you don't want to send the letter out hit Disagree and let's see what happens. Yes, great. Can anybody count higher than three? Okay so six to six, pretty darn good.

12 Page 12 Stephanie. One, two, three, four, five, six. One, two, three, four, five eight, nine, ten. All right so here s what I m going to do, I m going to read my Skype messages, yes more reds than greens. So I m going to nonetheless I m going to touch up this letter so we have it in our back pocket because I think we're 90% done, some good work s gone into it and I want to have it ready. And then I m going to write to the GNSO Council and or maybe ask Rafik to do it- I m going to write to the GNSO Council with Rafik s good advice and say we're going to hold off on sending this letter right now but not preclude sending it into in the future as we have a, you know, get some feedback from the Council. And we can even provide, you know, a draft of this letter. So if that s okay with everybody we ll leave this agenda item behind. And, you know, I think it was a really good discussion and I m sorry it took up so much of our valuable time but I guess it was necessary. Okay, the next update item is the SOW, the Statement of Work for legal counsel that I just sent around that Stephanie and Diane worked on Diane and Stephanie worked on over the last 48 hours for us. So if you would put that up? You haven't had a chance to look at this so I m going to give you a chance to read it. I m going to provide some initial feedback and that is I really want to so what Diane and Stephanie suggest here is the scope. And then they provided two sample questions to provide an idea of the type of questions we would be asking. So, you know, I haven't had too much of a chance to read it even though it came out last night I think. So I have, you know, you can scan through it and then, you know, we ll take comments online. But, you know, at the end of the day I think what's going to be sent out is going to be massaged some by ICANN so I think we need to realize that and so not be too worried about word-smithing even the sample questions are just samples and to not be answered but just are exemplars.

13 Page 13 The changes, you know, I d make to this is I really want to manage the expectation of those that bit on it. So I view this as sort of a not a, you know, pay so much per month but really we're buying these services by the pound, right? So we have questions, you know, and we have this we ll have a process where we ll compose questions, send them, the law firm will respond in writing and then, you know, then if need be we have a conference call later to, you know, to iterate the answers and make sure we have a clear understanding of what's going on. So I want to manage the amount of time spent by us and by them and the expense by creating that sort of process in this. So while they may be on call for five months, you know, there s certainly going to be a period a flurry of initial activity that we hope will go (unintelligible) to zero pretty fast and that the retainer will be, you know, used up as they spend time and the actual time working on things and not as some sort of monthly fee. So I want to make that clear in there and then and then I think it s pretty clear but I want to make it clear too that the sample questions are just samples and to indicate the sort of expertise we're looking for. So I ll pause for a minute and see if there are any questions about this. Kavouss, I m going to assume that s a former hand and go to Ashley, so please go ahead, Ashley. Kavouss Arasteh: Yes, Kurt, I can come to (unintelligible) the previous one; this is an important letter. I don't know at what stage this draft is. I receive it three minutes before the meeting. Perhaps I was lazy; I have not opened it before. But I have not studied it, I just give a very quick look, two or three minutes. But I think the content of this letter is very important. We should look at that very carefully because it seems some sort of the scope of the activity and work that we expect from the counselor or counsel or law firm, so we should look quite carefully o that.

14 Page 14 I don't have any specific proposal at this stage but perhaps we should ask people, maybe one from each constituency or maybe some other people, to look at them quite carefully to see whether there is whether there is any need to have an edit to that because this should be quite clear what really we expect from that because this four or five months and in fact would be less than five months because they have to find other things before that 5.5 months. So I suggest that you and all distinguished colleague agree, we just think it over a little bit, sleep on that for one or two days or a few days, and then try to finalize that if everybody is comfortable with the content of the letter and the views of everybody is satisfied. And that is the suggestion that I make. Thank you. Thanks, Kavouss. And you're right, I sent it out just before the meeting and with the idea that you would review it after this meeting and come back with comments. You know, I ll also say that of me anyway, SOWs are sort of like conversation starters, right, you want to find the right firms with the right level of expertise and then get into a negotiation where the final statement of work and the fees and all the negotiations are tightly honed. So I agree that we have to be we have to read this carefully and get it out but also realize you know, it s a conversation-starter for ICANN to get the right people on board. Now, Ashley, please go ahead. Ashley Heineman: Thanks, Kurt. So having been on at least one of the calls where this conversation got started, I m still not while I like the idea of getting some kind of neutral informed guidance other than through the formal Data Protection Board channel, I m still not 100% convinced that procuring services is going to best service us in large part I think folks have already indicated the cost but also the process of actually the time that it takes to procure services. And I would just hate to find ourselves in a situation where

15 Page 15 we spend a lot of time and potentially monetary resources and don't really get much out of it. So I just wanted to flag there. Also when looking at this, I will have to look at it again more clearly and more in a more detailed fashion because I do think that there s some improvement that needs to happen with the questions. And I thought we had indicated the need to add more to this. But I think something else that would be helpful if we do go down this route, whether it s, you know, procure legal services or something else is that we make it clear that we expect them to refer back to the guidance we've already received from Working Party 29 as well as through the European Data Protection Board because I think there s a lot there already. I think we have a lot of information that s been provided to us, it s just, you know, we haven't really maybe necessarily been able to use it the way we should have been doing or perhaps we have some differences of opinions and being able to benefit from someone with more of a GDPR legal expertise would be able to sort it out for us, because I think we have quite a bit of information available to us and I think it would be unfortunate if we second guessed that information because I think it was pretty spectacular that we got that kind of feedback and we shouldn t throw that out. Thanks. Thanks, Ashley. I think that s right. And I think the exercise of really honing our questions is will be as helpful to us going through that exercise as it will be in getting the answers. I also want to point out in the second small group meeting we had on this, you know, Thomas Rickert did point out some advice we got from the Data Protection Board that seemed very vague to us that we d need clarification on so there are there do exist questions where I think we ll want some outside advice. Marc. Marc Anderson: Hey, Kurt. Marc Anderson for the transcript. I like the other side, I didn't get a chance to read this before the call so I will do that and comment appropriately. But I raised my hand because, you know, there s a

16 Page 16 conversation going on in chat around budget implications. And, you know, I think, you know, I think maybe that s maybe important that we bring that to the forefront. You know, if the working group decides that this is important and we need independent counsel, you know, I think we, you know, we need to make sure this can be paid for, you know, and, you know, Kristina pointed out, you know, if money s an issue, you know, the GNSO Council has asked, you know, what we need and if, you know, if there are issues here with how we're going to pay for it, let s, you know, let s raise that to the forefront now. You know, I think there s probably somewhere money to be had for paying for this and so if we determine that this is what we need let s make sure we can pay for it and make sure, you know, if there s red tape or hurdles to getting this paid for, let s bring that to the forefront now so that we can, you know, we can get that addressed. As others have mentioned, if we, you know, if we need this we're going to need it quickly and so I d hate for us to spin our wheels with red tape getting this paid for. Thanks. And I would hope thanks very much, that s a good comment. And I d hope that, you know, my job and Rafik s and certainly the support staff is to navigate all that stuff. And certainly you know, we wouldn t spend money we don't have to even if we had the budget and we wouldn t not do something we absolutely have to do because of a budget issue. So I think we walk that line pretty well. And part of this effort is to demonstrate, one, to ICANN that we really need it; and two is to demonstrate we're doing it in the skinniest way possible and still get what we need. Margie, please go ahead. Margie Milam: Sure. This is Margie. A couple observations. One, what's the process for actually selecting the counsel? And will there be a question regarding whether they ve already provided advice to, you know, contracted party or other party in the ICANN stakeholder model? So I think that may affect the analysis provided. And also, is this list of questions I m not sure how we got

17 Page 17 this has someone gone through the initial report to glean out all the areas where there were questions? And how do we add to it? Because I imagine there s other questions we might ask. So the process is that ICANN procures the services, they will go through a process where they look at potential they solicit potential vendors, interview them, you know, the typical procurement stuff. They have an expedited process for doing that as they have done for us in the past. I think that to try to answer your real question I hope is that if you think there are certain prerequisites or experiences that should be required of this firm, in order to do the things we need them to do such as working in this multistakeholder model before or providing certain types of advice before a certain experience, I d ask you to add those to the SOW to make sure that to make sure that those really valid concerns are addressed. So that s the answer to Number 1. And then the answer to Number 2 I think is that we the thinking in putting these questions in there was that we d show them some examples or exemplars of the type of question that we would ask so it s not supposed to be an exhaustive list, it is just meant to illustrate the level of complexity of the question. I m not saying they're particular complex, I m just saying that, you know, it s meant to demonstrate the sorts of things we're interested in so it s only an example; we're not asking for answers to these questions at this point. And so I think and I think the SOW has to be you know, triply clear on that, that these are just exemplar questions. Margie Milam: Sure. If I could reply Yes. ((Crosstalk)) Margie Milam: hard to find a counsel that understands the industry and hasn t already weighed in on this? I m just trying to, you know, I m not sure, you know, I m

18 Page 18 saying that it s completely off the table but I think knowing that they represented, you know, a contracted party or not or someone else that's actually in the industry. I think at least helps, you know, inform, you know, whether they have a particular perspective and, you know, we may or may not still go with them because if you can't find someone you can't find someone but at least we're going in knowing that they ve already provided advice in this area for, you know, a registry or a registrar, as an example because, you know, I think understanding who s, you know, understanding our industry is actually really important so that you may end up with those. So I just think it s something we need to ask. Thanks, Margie. Kavouss. Kavouss Arasteh: Yes, as I said before I have not read the paper quite carefully but a quick look again while the other people are talking I think the Question 1 is part of Question 2, sorry, Question 2 is a (substantive) part of Question 1. I think we have an experience before whenever there is something of legal status or legal nature we need to raise it with someone outside to have a fresh look from the outside point of view. We did that during the CWG, the Cross Community Working Group on Naming and during the CCWG Work Stream 1 when we had legal questions. But we should also consider that these legal people, I don't know, they are (expensive) people and costs a lot of money even though we have the budget we should not spend the budget without any reasons; budget could remain and could be appropriated to elsewhere. Nevertheless, the Question 1 for me for the time being is (treated) to be a question if it s further developed and so on so forth. But I believe that it may be early at this stage to raise this question. We have to wait until we receive the public comments which is the 20th of December,

19 Page 19 so maybe about 5th of January or 10th of January they are clear answer of the public about these sort of thing between natural and legal and if the legal has a representative it could be the natural person and if information is not correct or is considered to be not correct what we have to do. So I think we have to wait but once again I think we have to look at the question and we have to put it in a proper order whether Question 2 is a part of Question 1 or not, and then wait until we receive some answers, maybe some of the answer help us. But I don't believe that there are all answers available as Ashley mentioned. There are some, the different views between the people, so we have to find it out. And we had (unintelligible) in the CWG or CCWG we had different views and so on so forth and that would be good to raise the question once it s approved by the group. So I m not against sending this but I suggest that perhaps we should wait until we receive information on the public comment. Thank you. Yes I think it d be Kavouss, I think it d be dangerous to wait that long because there's going to be a process by which, you know, we solicit, you know, it ll take time to get somebody on board and we ll want to be asking them questions right away. So that s a balancing we ll have to do. I m also kind of in thinking about it because I've just seen this too, you know, I m sort of a proponent for putting in some sample questions because you know, just putting in, you know, we need EPDP or we need GDPR expertise or something like that is broad and if sample questions can help identify an appropriate service provider I think that'd be helpful. Thomas. I think it makes the SOW more meaningful. Go ahead, Thomas. How are you? Thomas Rickert: Good. How are you Kurt? Hey everyone, two quick points. One, I think in the letter there's one component that I would like to see added and that is that the advisor should provide some training on or coaching on methodology. You know, specific questions might lead to specific answers. We should, you know, as we tried with the various temp questions at we've done for the worksheets, we need somebody to do sanity checks on the that we're

20 Page 20 covering all areas that need to be covered for, you know, somebody to be able to establish that we have made the system compliant. That s one. The other point is on cost. While it s true that, you know, any legal counsel that we retail would produce costs, I see bigger cost risk in us seeking legal advice from an independent counsel and ICANN seek legal ICANN Org that is seeking legal advice in parallel and then we might end up with contradictory or, you know, inconsistent advice probably during the drafting phase of our report but maybe also during the phase where the Board is checking whether or not they should adopt our report. And I guess that could easily double the costs or even enter into a battle of legal expert opinions that we ve solicited. So maybe this is something that s difficult for Trang or Dan to respond to now, but I think the most cost efficient way would be if ICANN Org and this team could agree on asking just one independent counsel and then taking their advice for you know, for what it should be, right, and not enter into competing or soliciting various legal opinions that might be conflicting. Sorry, I was on mute. I think that s a terrific point, Thomas, and something that we should explore. Alan Alan Woods. Alan Woods: Thanks. Yes thanks, Kurt. I was about to do a mini-moan there and then Thomas came along and gave us brilliant suggestion so actually I like that concept and I certainly would like to think more about that. But I think my point is just the conversation that we're having now can I just suggest that we perhaps move it to the list at this point because we're already 50 minutes in the meeting and I know this is important but a lot of us haven't really digested what is in that letter and I think we should just read it first and I think we should probably jump a little bit into the substance because we're coming up to an hour left and we have a lot to get though today.

21 Page 21 So apologies, it was a mini-moan but also well done, Thomas, you kind of took the words out of my mouth. Yes, see, it was worth it. Go ahead Alan Greenberg. Alan Greenberg: Thank you. I just wanted to respond to the comment of that we should defer this. Past experience says if we end up needing counsel that ICANN does not currently have a business relationship with, it can take significant time for ICANN to do all of its due diligence and paperwork. So we really can't defer in starting the process. We can defer asking questions but we can't defer in starting the process. Thank you. Thanks. So let s take Alan Woods s suggestion if you have other concrete suggestions to make to this statement of work, and I have a few, please add them. And then, you know, unless somebody thinks it s a really bad idea I m going to take Thomas's suggestion and, you know, write that in the cover letter that would go with the statement of work that we send to ICANN. And so Stephanie's still voting no, so I don't know if she s voting no on what I just said or something we said a long time ago but let s move that to the list. And so please give your input on the statement of work and you know, I understand that we've taken up a lot of time but I think, you know, they were not substantive but important discussions to have. Amr, please go ahead. Amr Elsadr: Thanks, Kurt. This is Amr. Just a quick question on do you envision a deadline of sorts by which we should be done with the SOW and or at least at which time we should be introducing the proposals on how to add topics t it? Yes, thank you very much. I bet you if I look at Skype Marika's asking me to make the same suggestion. So I d like the input on the SOW by the end of the week so we have today and tomorrow and then we can polish, you know, put it in a draft form and send it to ICANN. And gives us the right to amend it

22 Page 22 but I want to get the process going. And like I said, I view the SOW as kind of a conversation starter so I think we won't let the perfect be the enemy of the good. But I think we heard several good comments on the discussion so far and I m sure we ll get more thoughtful comments in . So thanks for that question, Amr. All right so let s go to the next thing in the agenda which is Purpose O. And Benedict asked me to take up the first 20 minutes of the meeting so he would be able to speak after that. I exceeded his expectations. We asked the team to provide some feedback on this on the list. And we've got essentially none, so this is kind of like the O for orphan purpose because it s kind of late coming and then there's not a lot of passionate discussion about it. I do have some questions but, Benedict, I know you ve introduced this in the past but if you could briefly introduce it, flesh out a little bit of the detail if you can anticipating what questions we might have and then, you know, we have to come to a decision whether or not we want to include this amongst our purposes for processing data. So, Benedict, if you could take that and then, you know, we want to decide whether we toss this or adopt it as a purpose or have to do more work. Go ahead, Benedict. Benedict Addis: Hopefully you can hear me okay. You can put I think thanks very much for covering the first 50 minutes, everyone. I think we did really well there. Why have I proposed a Purpose O? The answer is is that ICANN does internal stuff with registration data like compliance that s covered by Purpose F that we don't kind of have covered elsewhere in the in our report right now. It s the kind of activity I m talking about is research to write reports, so looking at longitudinal trends in domain name registrations, and looking for and more tactical research on security so things where ICANN is going to be position of being able to sort of look at, you know, look across domain names and particularly as it seems that that ability is going to not be available through the likes of Domain Tools and so forth.

23 Page 23 We kind of from the security side we mourn that loss but we also understand that, you know, this is a new world. So I think that creating a purpose for ICANN to achieve this kind of research is reflects what happened before the 25th of May and it s something that s required within ICANN to deliver some of its work and support its mission. There are two ways Thomas and I chatted about the sort of legal side of things. There are two ways of going about this under GDPR. You're allowed you're essentially an organization is permitted to do research in a really broad way as what's called secondary processing and that's not something we really talked about in this group. So we can take registration personal data that's been collected for another purpose and then without (unintelligible) consent there are some areas that where secondary or subsequent processing is allowed without having to go and get consent of the subject again. And that's dealt with by Article 6.4 and is specific research exemption is Recital 50 so if anybody wants to go and look those things up, Article 6.4 and then Recital 50. So this is something we can do without a specific purpose and ICANN can feel is allowed to do but in the interest of transparency Thomas and I and I think I m characterizing correctly eventually decided that it d be better to have a separate purpose so that it s completely clear to registrants what where their data is going to be used. And it s a really limited and just coming onto the lawful bases, so the and the it would still be under 6.1(f) and the kind of data that would be processed would be extremely limited. We d purely be talking about a limited set of pseudonymized data probably and again this would be open for discussion but probably address and we've put registrant name, address, and but those would be securely hashed.

24 Page 24 Separately SSAC have also developed a secure hashing function to demonstrate this is a proof of work and I ll circulate that to the list now so you can have a play and put your own addresses in there but basically you put an address in and you get a hashed version out. And to be very clear, this data would not be shared anywhere beyond ICANN; this would purely be for ICANN's internal work. I hope that's clear. So on that I've probably forgotten a few things but so please give me some questions and hopefully you ll hear me I think I can hear Farzaneh saying, I m whispering. And I hope you can hear me okay. Thanks very much. Thanks, Benedict. So let s hear the questions. James. James Bladel: Thanks, Kurt. James speaking. And thank you, Benedict, for teeing this up, this conversation, and I think you offered some important clarifications there at the end. So just so I m 100% clear, this data would be or sorry, this purpose would be for ICANN to collect the data for research purposes and then that data would not necessarily be shared with third parties but the results or findings of the research would be shared. And is that my am I understanding that correctly? The data would not be shared but the findings would be shared and is that a function or a role that ICANN is willing to take and is looking to take? And I guess then I turn the question away from Benedict and now point it squarely at Dan and Trang, is that, you know, is that a case and a justification that ICANN the organization believes is part of their mission and they would like to undertake that role? So those are just my questions. And again, if I've missed something, I apologize, but I m just trying to get a handle around the roles. Thanks. I think ((Crosstalk))

25 Page 25 Go ahead. Benedict Addis: Sorry, Kurt. So yes, this is purely for disclosure to ICANN and in a pseudonymized way. This the idea is and some of the language I just discussed with Farzaneh would be is about research and published reports, so in other words so ingest the data, pseudonymized only, and publish on so publish open reports on threats to the DNS. So yes, absolutely it would be intended the output of this process would be intended for public consumption but there would be no disclosure there. Then I have spoken to Dan about this and he's the people he needs to speak to are mostly in (OPTO) and SSR so that s folks like John Crane and Dave Conrad. And I happen to know they're just on their way back from Moscow right now and so Dan hasn t had a chance to speak to them yet, so he has got back to me about this; he hasn t take a decision or ICANN hasn t taken a decision collectively but so I m and I need to be very clear, I am to some extent putting creating this purpose so that ICANN can continue doing its work. This is by no means the only way to achieve this goal but it seems to me to be the most transparent way to achieve research, to be clear to the registrants about what's required and to bind the work to make sure that it s not too wide because I noticed that Amr has said how can we make sure that it s guaranteed that only is only used for research. And Amr, that s what we use GDPR for, it s the risk of fines that guarantees that. Thank you. Oh I m sorry, go ahead, Alan Greenberg. Alan Greenberg: Thank you very much. Alan Greenberg speaking. Given that we are working in a different environment where we no longer will have the public data available we used to have, given that it is ICANN's responsibility to look at the identifier system, and that includes evolution of the identifier system, and to

26 Page 26 consider risks to that identifier system, I don't see how we cannot do this. I would think whether there is a need on the books today that says they must have this, and whether they have done it before I think is quite irrelevant because the world we were looking at before was very different and the data was available without asking anyone s permission for it, I don't see how we can restrict ICANN from doing this or even attempt to. As Benedict pointed out, we might be able to do it anyway under the current procedures, you know, even if we don't have an explicit purpose, but I agree that it should be there and it should be blatantly clear that ICANN does have a responsibility to ensure that things are okay in the future and understand the environment well. And I don't see how we could tie its hands behind its back by saying it can't do this. So I really think it a no-brainer that there s no question we ve to be able to do this. I would also presume, but I ask for clarification, that if we do this, this also would allow ICANN, under appropriate nondisclosure, to subcontract some of this work if that s appropriate. Thank you. Thanks, Alan. Benedict, do you just want to manage the queue and then you can choose when to respond or when to go ahead? Benedict Addis: Sure. James, is that a current hand? Is that a follow up on your question? James Bladel: Old hand, sorry. Benedict Addis: Sorry, I saw it disappear, I m using my phone so apologies. I m a little slow on the uptake. Kavouss, I've seen you ve written in the chat you ve asked a question about the secondary purpose. Would you like to clarify your point please? Kavouss Arasteh: Excuse me, are you asking me to clarify? I heard somebody say second purpose, I said what is secondary purpose? Thank you.